'.vendetta File Extension' Ransomware

The '.vendetta File Extension' Ransomware is a part of the RSAUtil Ransomware family that uses AES (not RSA) algorithms to lock your files until you agree to pay its fee. Since these ransoms are high-risk transactions, any victims always should try other options preferentially, such as reverting to their last backup. Any security software with anti-malware features also may impede the data-locking attack by deleting the '.vendetta File Extension' Ransomware at the outset.

One Program's Vendetta against Your Files

The RSAUtil Ransomware is showing likely inclinations towards RaaS (or Ransomware-as-a-Service) for its operations. File-locking threats using this form of service allow other threat actors to rent them and distribute them with minor updates, such as changes to the ransom details or the types of files that they harm. This black market business model results in potential floods of variants, although malware experts only can confirm a handful, like the '.vendetta File Extension' Ransomware, for this family.

The '.vendetta File Extension' Ransomware doesn't, despite its ancestor's name, use the RSA encryption to lock your files. Instead, it encrypts media with a Rijndael-derived cipher such as the AES-128. For stealth purposes, this Delphi Trojan also can inject a bad code into other processes and, like RSAUtil Ransomware pretends to be a Windows component. After the attack finishes, victims can determine what content the Trojan is locking by the extension it adds, which includes two ID fields and the 'VENDETTA' string.

Malware experts are collecting ransom notes from the '.vendetta File Extension' Ransomware infections that include HTA pop-up windows, Notepad text, and desktop wallpapers. Limited numbers are available on the cost of the ransom, although the threat actors specify using Bitcoin, which could let them take the money without giving the user back the file-unlocking code.

Smoothing over the Pangs of Vindictive Software's Behavior

There are verifiable instances of threat actors using the RSAUtil Ransomware's family to conduct attacks, collect the ransoms, and, then, avoid giving the 'customer' any help. Since this behavior is always a possible risk from these transactions, malware experts emphasize storing updated and secure backups as the preferable way of protecting your files. The media that's at the highest risk, although not exclusively so, includes Microsoft Office content, Adobe PDF documents, pictures, music, movies and archives.

Threat actors can use drastically different ways of distributing and installing RaaS-based Trojans individually even if the programming-based differences between two variations are minimal. Although malware experts are finding the most infections associated with e-mail spam messages and their fraudulent attachments, the cybercrooks also may drop the '.vendetta File Extension' Ransomware through a website's exploit kit, disguise a torrent, or brute-force their way into a business's network. Having a combination of anti-malware protection and adhering to core security standards can reduce these issues and help delete the '.vendetta File Extension' Ransomware before it has any time to lock your files.

One always takes a gamble when giving money to cybercrooks in an under-duress situation. The '.vendetta File Extension' Ransomware should remind any readers that this is just as true for software-based interactions as face-to-face negotiations with a robber.